CVE-2023-5171

What it actually does

Use-after-free during Ion compilation triggered by garbage collection allows an attacker to write two NUL bytes and trigger an exploitable crash.

Why it matters to the business

Service or application crashes can interrupt operations and user access; high downstream usage of the affected component increases exposure and urgency for patching across many deployments.

How an attack unfolds

An attacker crafts input that reaches Ion compilation, forces a garbage collection at a precise moment to create the use-after-free, then uses the resulting write of two NUL bytes to corrupt memory and crash the process; threat actor references to related Chromium issues indicate similar heap manipulation techniques have been observed in the wild.

How to fix it

Upgrade crafatar/crafatar (GIT) to commit bba004acc725b362a5d2d5dfe30cf60e7365a373; apply the equivalent fixed version for any downstream dependents.

How to confirm the fix worked

Confirm the running version or commit hash matches bba004acc725b362a5d2d5dfe30cf60e7365a373 and re-test the Ion compilation path with crafted inputs that previously triggered the crash.

Typical attack path

1. Deliver malicious input or page that triggers Ion compilation path
2. Induce garbage collection at the vulnerable timing window
3. Exploit the freed object to perform the two-byte NUL write
4. Trigger memory corruption leading to denial-of-service crash

How to detect it

Review application or browser process crash logs for Ion compilation faults, unexpected NUL byte writes, and use-after-free signatures; correlate with web request logs that reach the compilation stage.

What your security team should do

• Prioritize upgrade of all instances to the listed fixed commit within the next patch cycle
• Monitor EPSS trend and re-evaluate exploit maturity weekly
• Add the affected component to the vulnerability scanning inventory